Measure · ISO 27001
Apply privacy requirements to a processing activity
Connect an actual processing activity to applicable requirements, owners and effective safeguards. Use your existing processing records.
Reuse existing records
Reuse processing records, the obligations register and authoritative access, information protection, deletion and incident procedures. If you lack a register, use the supervisory authority’s sample for your role.
What to do
- 1
Identify the activity and role
Walk through actual purposes, data, people affected, recipients, suppliers and countries. Establish your role and applicable laws and contracts. Update the existing processing record and examine lawful basis, necessary data and information for individuals.
- 2
Implement procedures and safeguards
Assign access, locations, retention, deletion and appropriate technical and organisational measures. Clarify processor arrangements and international transfers where applicable. Link authoritative rules and owners, and instruct the people who apply them.
- 3
Assess additional privacy duties
Check whether the law requires a data protection impact assessment or a data protection officer. If you need an assessment, describe the processing and purpose before it starts. Explain necessity and proportionality, assess risks to individuals and define safeguards. Seek advice from your data protection officer if appointed. Consult the supervisory authority before starting if a high risk remains.
- 4
Handle rights requests and incidents
Assign a reachable channel and an owner for rights requests. Verify identity when there are reasonable doubts and respond within applicable deadlines. Use the existing incident process for personal data breaches, including an assessment of reporting obligations.
- 5
Check operation and changes
Compare the processing record with actual data and implemented protection. Handle errors in the existing record and preserve decisions and effectiveness checks. Review changes in purpose, data, recipients or technology as well as at suitable regular intervals.
Worked example
An operational example
Fictional example: A support portal processes customer names and error descriptions. Its existing processing record is reviewed before a new supplier is connected.
- New recipient
- DecisionThe owner checks purpose, necessary data, contractual role, locations and required safeguards before transfer begins.
- EvidenceUpdated processing record with reasoned decisions and references to applicable agreements.
Record the result
- Current processing record and reasoned applicable requirements.
- Implemented procedures and safeguards with checked results.
Common implementation mistakes
Treating a blank template as a privacy programme
A processing register organises information. Lawfulness, protection, rights handling and necessary additional assessments must be established for actual processing.
Related requirement
The references below show which requirements the measure contributes to.
View controls and standards
- A.5.34 · Datenschutz und Schutz personenbezogener DatenGerman guide
The workflow connects applicable privacy laws and contracts, ownership, communication, safeguards and procedures to actual processing. Legal decisions depend on the organisation and activity.
